bifrost: ...

1 files changed, 9 insertions, 9 deletions

diff --git a/hosts/vidhar/network/ruleset.nft b/hosts/vidhar/network/ruleset.nft
index 7b2160d1..f2b1eda0 100644
--- a/hosts/vidhar/network/ruleset.nft
+++ b/hosts/vidhar/network/ruleset.nft
@@ -117,10 +117,10 @@ table inet filter {
 
 
   chain forward_icmp_accept {
-    oifname dsl limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-fw drop
-    iifname dsl limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-fw drop
-    oifname != dsl limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
-    iifname != dsl limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
+    oifname { dsl, bifrost } limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-fw drop
+    iifname { dsl, bifrost } limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-fw drop
+    oifname != { dsl, bifrost } limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
+    iifname != { dsl, bifrost } limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
     counter name icmp-fw accept
   }
   chain forward {
@@ -133,7 +133,7 @@ table inet filter {
 
     iifname lo counter name fw-lo accept
 
-    oifname {lan, dsl} meta l4proto $icmp_protos jump forward_icmp_accept
+    oifname { lan, dsl, bifrost } meta l4proto $icmp_protos jump forward_icmp_accept
 
     iifname lan oifname { dsl, bifrost } counter name fw-lan accept
     iifname dsl oifname { lan, dmz01 } ct state {established, related} counter name fw-dsl accept
@@ -158,8 +158,8 @@ table inet filter {
     iif != lo ip daddr 127.0.0.1/8 counter name invalid-local4-rx reject
     iif != lo ip6 daddr ::1/128 counter name invalid-local6-rx reject
 
-    iifname dsl meta l4proto $icmp_protos limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-rx drop
-    iifname != dsl meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-rx drop
+    iifname { bifrost, dsl } meta l4proto $icmp_protos limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-rx drop
+    iifname != { bifrost, dsl } meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-rx drop
     meta l4proto $icmp_protos counter name icmp-rx accept
 
     iifname { lan, mgmt, dsl, yggdrasil, bifrost } tcp dport 22 counter name ssh-rx accept
@@ -201,8 +201,8 @@ table inet filter {
 
     oifname lo counter name tx-lo accept
 
-    oifname dsl meta l4proto $icmp_protos limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-tx drop
-    oifname != dsl meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-tx drop
+    oifname { bifrost, dsl } meta l4proto $icmp_protos limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-tx drop
+    oifname != { bifrost, dsl } meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-tx drop
     meta l4proto $icmp_protos counter name icmp-tx accept